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Experimental demonstration of counterfactual quantum key distribution 
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Counterfactual quantum key distribution provides natural advantage against the eavesdropping on 
the actual signal particles. It can prevent the photon-number-splitting attack when a weak coherent 
light source is used for the practical implementation. We realized the counterfactual quantum key 
distribution in an unbalanced Mach-Zehnder interferometer of 12.5-km-long quantum channel with 
a high-fringe visibility of 96.4%. As a result, we obtained secure keys against the noise-induced 
attack (eg. the vacuum attack) and passive photon-number-splitting attack. 

PACS numbers: 03.67.Dd 



Quantum key distribution (QKD) provides an un- 
conditionally secure communication between two remote 
parties (Alice and Bob), where the security is guaranteed 
by the fundamentals of quantum mechanics [l], Q . How- 
ever, current techniques cannot support to implement 
the ideal quantum cryptography experiment as originally 
proposed due to the lack of efficient single-photon or en- 
tangled photon-pair sources in the near-infrared region. 
So far, in practical long-distance fiber-based QKD sys- 
tems, weak coherent light sources have been used in- 
stead of ideal single photons [3|-l5|- Intelligent meth- 
ods have been invented to prevent the photon-number- 
splitting (PNS) attack based on the multi-photon pulse 
of the weak coherent light sour ce B ~ial ■ Among them, the 
decoy-state QKD protocol [l0l - tl2j could prevent the PNS 
attack by statistical security analysis of a large yield of 
the photon clicks [HI, E3] ■ On the other hand, quantum 
counterfactual effect has been discussed in interaction- 
free measurement 15-17| and developed for the quan- 
tum computation Recently, an interesting coun- 
terfactual QKD protocol was proposed [2l| to distribute 
secret keys without any secret information-carrier qubits 
transmitting in the quantum channel, which can in prin- 
ciple prevent the eavesdropper to directly access the en- 
tire quantum system of each qubit. For example, secret 
key can be established by using the quantum counterfac- 
tual effect in a Michelson interferometer between Alice 
and Bob. One arm of the interferometer is in Alice's se- 
cure site, and the other arm is used to connect Bob as the 
quantum channel. Unlike previous QKD protocols which 
generate secret keys by transmitting the signal particles 
through the actual quantum channel, the proposed coun- 
terfactual QKD generates secret keys in the case that the 
photonic qubits only transmit in Alice's arm but never 
travel through the quantum channel to Bob. Interest- 
ingly, as a weak coherent light source is used, the quan- 
tum counterfactual effect provides a natural advantage to 
prevent the PNS attack by avoiding Eve's access to the 
information-carrier photons. Experimental demonstra- 



tion of such a counterfactual QKD requires a stabilized 
Michelson interferometer [22l |. 

In this letter, we experimentally demonstrate the coun- 
terfactual QKD based on a round-way unbalanced Mach- 
Zehnder interferometer with 25 km fiber length difference 
between the long and short arms that ensured an effec- 
tive 12.5-km-long quantum channel between Alice and 
Bob. Possible eavesdropping against the counterfactual 
QKD was analyzed. The counterfactual QKD scheme 
was implemented with the capability to reveal the vac- 
uum attack by monitoring the photon detection distri- 
butions. With a high-fringe visibility of 96.4%, we could 
obtain secure keys against the passive PNS attack by an 
average photon number of 1 per pulse. 

The counterfactual QKD system was composed of a 
round- way unbalanced Mach-Zehnder interferometer as 
shown in Fig. [T] A 1550-nm DFB laser diode (LD) gen- 
erated a series of short pulses with the repetition rate of 
5 kHz, which were adjusted to horizontal polarization at 
the input of the interferometer. The laser pulses were re- 
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FIG. 1: Schematic of the counterfactual QKD system. LD: 
1550-nm DFB laser diode; Attain : variable attenuators; 
PCi-s: manual polarization controllers; Cir: circulator; 
BSi,2: 50:50 beam splitters; PRi,2: polarization rotators; 
PM: phase modulator; HR: high-reflection mirror; PBS: po- 
larization beam splitter; Di_3: single-photon detectors. 
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fleeted by a high-reflection mirror (HR), and attenuated 
to single-photon level before returning the interferometer. 
A pulse from the laser source might travel one of the four 
paths by the selection of the short arm (s) or long arm 
(/) in the forward and backward transmissions, denoted 
as (ss), (si), (Is), and (11), respectively. We disregarded 
the photon paths 11 and ss in the counterfactual QKD, 
since 11 states contained no information, and ss states 
were in Alice's secure station with no information leak. 
Only the photons travelling si and Is paths contributed 
to QKD, and the interference was automatically stabi- 
lized since photons travelled the fiber paths of exactly 
the same length. Four manual polarization controllers 
(PC2-5) were adjusted for compensation of the polariza- 
tion drifts in the long-distance fiber to make the photons 
of si and Is paths interfere with the same polarizations 
at the output of the static interferometer. 

The static interferometer was then used to 
polarization-encode the qubit in both Alice's and 
Bob's sites with two polarization rotators (PRi and 
PR2), which were randomly controlled to rotate the 
polarization state by either 0° or 90°. In the forward 
transmission, Alice randomly modulated the laser pulses 
passing the short arm to the horizontal or vertical 
polarization direction. Then two possible quantum 
states of the photon pulses were prepared as 

\^ ) = (\o) sl \H) ls + \H) sl \o) ls )/V2, 

\il>x) = (\V)si\H)i s + \V) s i\Q) ls )/V2, 

where |0) is the vacuum state, \H) and \V) denote the 
horizontal and vertical polarization states, defined as the 
bit value of and 1, respectively. In the backward trans- 
mission, Bob decoded the polarization states with the 
polarization rotator (PR%) and the polarization beam 
splitter (PBS) by randomly applying a 90° or 0° po- 
larization rotation on the split pulse in the long arm, 
corresponding to the bit value of or 1. If Alice and 
Bob chose the same bit value, the split pulse in the long 
arm was reflected to the single-photon detector D3 by 
the polarization beam splitter. The quantum states \i/jq) 
and |^i) both collapsed to \V) st \0)i s or \0) s i\H) is . The 
photon travelled either the short arm, which was then 
detected by the single-photon detector Di or D 2 with 
the same probability of 1/4, or the long arm, which was 
then detected by the single-photon detector D3 with the 
probability of 1/2. If Alice and Bob chose different bit 
values, the split pulse in the long arm passed through 
the polarization beam splitter. The quantum state kept 
the interference, and the photon pulses went toward the 
single-photon detector Di, wherein |^o) was unchanged, 
and I '01 ) was transformed to |^>o) since the polarization 
of the split pulse in the long arm was rotated by 90° . 

Only the events that D 2 alone detected a photon would 
create the sifted keys, indicating that Alice and Bob have 
certainly chosen the same bit value and the photon pulses 
travelled the short arm. If Di or D3 clicked, Alice and 
Bob announced the detected results and their bit values. 



The performance of the interference could be calculated 
from these events to monitor whether there were any 
Eve's disturbance. We defined (CI, C3, C5) and (C*2, 
C4, C6) as the counts of the detectors (Di, D3, D 2 ) in 
the case that Alice and Bob chose the same and different 
bit values, respectively. The count of D 2 was randomly 
selected from the half of the events that D 2 clicked, and 
the other half events created the sifted keys. The per- 
formance of the interference and polarization extinction 
ratio of Alice's and Bob's polarization operation could 
be respectively characterized by CI : C2 and C3 : C4, 
where CI : C2 = 1:4 represents an ideal interference 
[HI). The interference fringe visibility could be calcu- 
lated by (4C5 - C6)/(4C5 + C6), while the error rate of 
the QKD system could be calculated by C5/(C5 + C6). 

As Eve had no access to the short arm and the 
information-carrier photons, many possible attacks that 
threaten the conventional QKD, such as intercept-resent 
and Trojan horse attacks, could be successfully pre- 
vented [24( . Eve may implement a possible eavesdropping 
by using "vacuum attack" , in which Eve operates the 
polarization-encoding on the vacuum state before Bob's 
site. Eve's choice of bit value (Be V c) may be the same or 
different with Alice's (Baucc) or Bob's (Bsob)- There are 
altogether four possible cases, (i) Bsve — B Alice — BBob, 
Eve may eavesdrop the sifted key with no errors for Al- 
ice and Bob. (ii) Be„ e = Baucc ^ BBob, the quantum 
state collapses, while Eve may eavesdrop the sifted key 
and induce an error for Bob. (iii) B^ve 7^ Baucc = Bsob, 
the photon keeps the interference and is detected by Di. 
(iv) BEve 7^ B Alice 7^ BBob, the quantum state collapses, 
while Eve may eavesdrop a sifted key with a possible 
error. Three of the four cases may create a sifted key, 
wherein Bob and Eve both have the error rate of 1/3 in 
the sifted key. According to the Shannon information 
theory, the information Eve and Bob get is described as 

1=1 + Dlog 2 (D) + (1 - D)log 2 (l - D), (2) 

where D is the error rate. Here Eve's information 
through the vacuum attack is only 8.17%, which is much 
less than 50% in the conventional QKD through the 
intercept-resent attack. Moreover, the vacuum attack 
changes the count of Di and D 2 , as well as CI : C2 — > 
1 : 2 [23[. 

The counterfactual cryptography naturally prevents 
the PNS attack when a weak coherent light source is 
used, because Eve even cannot detect the photon num- 
ber of each pulse in the long arm, and she has no access 
to the short arm [2l|]. Passive PNS attack would pro- 
vide Eve some information by inserting a beam splitter 
in the quantum channel to passively split the photon and 
replacing the quantum channel with her lossless channel 
to compensate the splitting loss. Eve's gain of the sifted 
key (Pevc) is extremely limited because only the joint 
event that there is at least one photon in each interfer- 
ometer arm is useful in this attack. The proportion of 
Eve's information to the total sifted key is given by 

Peve < P(^si , n > 0) • riio SS , (3) 
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where fi s i is the mean photon number of the photon 
pulse in the long arm, /x is the mean photon number 
of |V>o) or \ipl)- Here fi s i — 0.5 ■ fx, if the long and short 
arms have the same attenuation. P(/i,n) = e~''/i™ /n! is 
the Poissonian distribution for the photon number of n. 
rjioss = 1 — l0 _0 - 25ie /// 10 is the transmission loss of the 
quantum channel from BS2 to PC3, where L e ff refers to 
the effective distance between Alice and Bob. When the 
loss of the quantum channel is so large that r][ oss — > 1, 
Eve could nearly obtain all the information of the photon 
in the long arm, and her information gain won't increase 
with the communication distance any more. 

According to the Shannon information theory, the se- 
cure key can be distilled if Bob obtains more information 
than Eve. As shown in Fig. [5J Eve's maximum gain of 
the sifted key was less than 5% for the case fj, — 0.1, in- 
dependent on the large loss of the long-distance channel. 
As a result, the counterfactual QKD protocol provides 
an approach to the long-distance secure communication 
based on the quantum property instead of the statistical 
method such as decoy-state protocols. 

In the experiment, the total loss of the long arm was 
about 9 dB, while the loss of the short arm was only 
3 dB. The photon flux in the long arm was larger than 
that in the short arm in the backward transmission, re- 
sulting in an increase of Eve's gain. To eliminate the 
threaten induced by the unbalance of the two arms, we 
inserted an attenuator (Attn.2), and adjusted the total 
loss of the short arm to be the same as that of the long 
arm. Three home-made near-infrared single-photon de- 
tectors were used with the dark-count probabilities of 
1.0 x 10~ 5 , 5 x 10~ 6 , 1.5 x 10 -5 per pulse, respectively, 
at a detection efficiency of 10%. Due to the birefringence 
of the single-mode fiber, the photon pulses of Is or si 
path would cover a different phase shift when Alice sent 
the horizontal or vertical polarization state. As there was 
about 0.47T phase shift between two orthogonal polariza- 
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FIG. 2: Eve's gain of the sifted key. Dashed and solid lines 
show Eve's gain through passive PNS attack against the coun- 
terfactual and PNS attack against conventional QKD, respec- 
tively. The olive, black, blue, and red lines denote the mean 
photon number of 0.1, 0.5, 1.0, and 5.0, respectively. 
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FIG. 3: Photon counts of Di, D2 and D3 at various bit value 
choice of Alice and Bob with the acquisition time of 15 s. 



tion in 12.5 km single-mode fiber, we used a phase mod- 
ulator to compensate the polarization-dependent phase 
shift. The laser pulses were attenuated to contain 1 pho- 
ton per pulse on average. Then we measured the single- 
photon interference and the polarization extinction ratio 
of the quantum system. As shown in Fig. |3l when Alice 
and Bob chose the same or different polarization, the pho- 
ton pulses in the long arm were switched to D3, or passed 
through the polarization beam splitter to the output of 
the interferometer. The photon count of D 3 showed a 
polarization extinction ratio as high as 30 : 1. The sin- 
gle photon interfered at the output of the interferometer 
when Alice and Bob chose different polarization. Owing 
to the passive phase shift compensation of the round- way 
Mach-Zehnder interferometer, the phase shift caused by 
the slow variation such as random temperature and stress 
drifts were auto-compensated. In this way, we got a sta- 
ble interference with the fringe visibility of 96.4%. When 
Alice and Bob chose the same polarization, the quantum 
state of the signal photons collapsed, and we got almost 
the same count rates on Di and D2. 

The experimental demonstration of the counterfactual 
QKD was then carried out with the average photon num- 
ber (i = 1.0. Alice and Bob used two random number 
generators to drive PRi and PR2 independently. Ta- 
ble U presents the experimental results with an acquisi- 
tion time of 540 s. The whole system showed an unsur- 
passed stability during the acquisition. The counts of 
each single-photon detector and the coincidence counts 
between D3 and Di or D2 showed that the photon dis- 
tribution experienced no observable changes. The error 
rate Dab was 6.7%, mainly from the noise of the in- 
terference. Note that the counterfactual QKD requires 
a single-photon interference of a high-fringe visibility, 
which would have fourfold errors as the conventional 
QKD of the same fringe visibility. The interference er- 
rors were mainly induced by the polarization operation. 
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TABLE I: Experimental results of 12.5-km counterfactual 
QKD with the acquisition time of 540 s. 



Di 


15149 






D 3 


10577 


CI : C2 


1 : 4.1 


Fringe Visibility 


96.4% 


Polarization Extinction Ratio 


30.5 : 1 


Coincidence Probability 


0.15% 


Sifted key 


1121 


D AB 


6.7% 



The polarization extinction ratio was kept at 30.5 : 1 in 
the experiment. This error rate opened the back door for 
Eve to implement the vacuum attack against 20% of the 
vacuum states. However, it would change the counts of 
Di and D 2 , and CI : C2 — > 1 : 3.3 [23]. In the experi- 
ment, we got CI : C2 =4.1, implying that the error rate 
didn't come from the vacuum attack but was induced by 
the intrinsic noise of the QKD system. In this case, Eve 
may obtain 20% of the information through the passive 
PNS attack, while Bob's information was 64.5% accord- 
ing to Eq. [2] Note that Eve's information was restricted 
under a certain level under this attack (Fig. [5]) and was 
insensitive to the transmission loss. Since Bob's infor- 
mation was much more than Eve's, Alice and Bob could 
distill the unconditional secure keys at last by the clas- 



sical error correction and privacy amplification methods 

In conclusion, we realized the counterfactual QKD ex- 
periment in a round- way unbalanced Mach-Zehnder in- 
terferometer of 25 km fiber length difference between the 
long and short arms that ensured a fiber-based quan- 
tum channel of 12.5 km. Despite Bob had an error 
rate of 6.7%, we could ensure that there was no noise- 
induced attack according to the unchanged count dis- 
tribution of each single-photon detectors used in the 
QKD system, and secure keys could be obtained against 
the passive PNS attack. The key generation rate of 
the counterfactual QKD, which was mainly limited by 
the slow response time of the polarization rotators used 
in our experiment, could be increased with fast po- 
larization rotators and high-speed single-photon detec- 
tors [U HH . And the active polarization compensating 
methods have been invented for long-distance fiber-based 
QKD experiments [29j - [3~i| . which were quite useful to re- 
alize a long-term stable and long-distance counterfactual 
QKD system. The counterfactual QKD scheme was im- 
plemented with currently available technologies, promis- 
ing a robust and practical quantum cryptography system 
toward global secure communication. 
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(2006CB921105). 
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